Opinion issued August 26, 2025

In The Court of Appeals For The First District of Texas ———————————— NO. 01-24-00187-CV ——————————— KIMBERLY SOMER, CODY JANSSEN, AND ALLINE HENDERSON, Appellants V. OAKBEND MEDICAL CENTER AND OAKBEND MEDICAL GROUP, Appellees

On Appeal from the 434th District Court Fort Bend County, Texas Trial Court Case No. 22-DCV-298770

OPINION This case arises out of a data breach that occurred when cyber criminals infiltrated the computer network of a hospital group. Kimberly Somer, Cody Janssen, and Alline Henderson (collectively, “the patients”) sued OakBend Medical Center and its subsidiary OakBend Medical Group after their personal identifying information and personal health information (“personal information”) were potentially stolen in a cyberattack. The two OakBend entities filed pleas to the jurisdiction, arguing that the claims asserted against them did not fall within a waiver of governmental immunity. The trial court granted the pleas to the jurisdiction and dismissed all claims with prejudice.

On appeal, the patients contend that (1) OakBend Medical Group is a private nonprofit corporation and is not entitled to governmental immunity; (2) the tort claims fall within the “condition or use of tangible personal property” waiver of immunity found in the Texas Tort Claims Act; and (3) governmental immunity does not protect the OakBend entities from the claim for unjust enrichment.

We affirm as to the parent and reverse and remand as to the subsidiary.

Background In September 2022, cyber criminals launched a ransomware attack against the computer network and servers of OakBend Medical Center, a hospital authority that provides medical services to patients primarily in Fort Bend County. Although OakBend quickly learned of the attack and was able to take some measures to protect its system, the criminals accessed personal information relating to current and former patients and employees. This personal information may have included names,

mailing addresses, email addresses, phone numbers, Social Security numbers, dates of birth, and medical information. OakBend reported the attack to law enforcement authorities. OakBend also mailed letters to all potentially affected patients and employees, notifying them of the data breach and providing free credit monitoring for eighteen months.

Kimberly Somer, a former patient of OakBend, sued both OakBend Medical Center and OakBend Medical Group on her own behalf and on behalf of all others similarly situated. Somer’s petition referred to OakBend Medical Center and OakBend Medical Group collectively as “OakBend.” She did not differentiate between the two OakBend entities when describing the acts and omissions that allegedly caused her injuries.

Somer asserted a claim for negligence, alleging that OakBend knew of an increasing risk of cyberattacks on healthcare providers but failed to exercise reasonable care to safeguard and protect her personal information. As a result of OakBend’s negligence, Somer suffered harm including a substantially increased risk of identity theft. She also asserted a claim for negligence per se, alleging that OakBend’s conduct violated duties established by the Federal Trade Commission Act and HIPAA, a claim for breach of fiduciary duty, and a claim for breach of an

implied contract.1 Finally, she raised a claim for unjust enrichment, alleging that by paying OakBend for medical services, she also paid for “reasonable data privacy and security practices and procedures,” but OakBend failed to implement proper data security procedures and therefore it should not retain the monetary benefit it received from Somer and other class members. Somer’s lawsuit was assigned to the 434th District Court of Fort Bend County.

Somer was not the only former patient potentially affected by the data breach to file suit. Alline Henderson, Cody Janssen, and Janssen’s minor daughter were all former patients of OakBend, and Janssen was also a former employee. They filed a class action lawsuit solely against OakBend Medical Center and asserted nearly identical claims to Somer: negligence, negligence per se, breach of fiduciary duty, breach of an implied contract, and unjust enrichment.2 Janssen and Henderson’s lawsuit was assigned to the 240th District Court of Fort Bend County.

In later filings, Somer agreed to non-suit her implied contract claim. That claim is therefore no longer at issue in this appeal.

Like Somer, Janssen and Henderson later agreed to non-suit their claim for breach of an implied contract, and this claim is not at issue in this appeal. They also asserted a claim for intrusion upon seclusion/invasion of privacy, but they later requested that the trial court dismiss this claim without prejudice to refiling. The trial court did so. This claim is therefore also not at issue in this appeal.

OakBend Medical Center filed a plea to the jurisdiction in Somer’s suit, arguing that its governmental immunity barred Somer’s claims against it.3 OakBend Medical Center argued that as a hospital authority created by the City of Richmond, it was a political subdivision of the state and had governmental immunity from suit.

See TEX. HEALTH & SAFETY CODE § 262.003(a) (allowing governing body of municipality to adopt ordinance creating hospital authority). It further argued that no waiver of governmental immunity applied to Somer’s claims. It acknowledged that the Texas Tort Claims Act contains limited waivers of governmental immunity, including a waiver for personal injury or death “caused by a condition or use of tangible personal or real property,” but it contended that this waiver did not apply because personal information—the alleged theft of which formed the crux of all Somer’s claims—was not tangible personal property. It also argued that no waiver of immunity applied to Somer’s unjust enrichment claim, which sought monetary

In addition to its arguments relating to immunity from suit, OakBend Medical Center—as well as OakBend Medical Group in its plea to the jurisdiction—also challenged Somer’s standing to bring suit. OakBend Medical Center’s plea to the jurisdiction filed in Janssen and Henderson’s suit also challenged standing. When the trial court granted the OakBend entities’ pleas to the jurisdiction, it struck through the portion of the proposed orders relating to standing. Additionally, in separate filings from the pleas to the jurisdiction, the OakBend entities moved to dismiss both suits under Rule of Civil Procedure 91a, arguing that the patients’ claims had no basis in law. See TEX. R. CIV. P. 91a.1. The trial court ruled only on the pleas to the jurisdiction, not on the Rule 91a motions to dismiss. On appeal, the OakBend entities do not argue that these actions by the trial court were erroneous. damages. OakBend Medical Center filed a substantively identical plea to the jurisdiction in Janssen and Henderson’s suit.

OakBend Medical Group filed a separate plea to the jurisdiction. It also argued that governmental immunity barred Somer’s suit, but it relied on a slightly different source for its immunity: although it was not a political subdivision of the state, it was controlled and funded by OakBend Medical Center. As supporting evidence, OakBend Medical Group attached the declaration of Joseph Freudenberger, the CEO of OakBend Medical Center and the president of OakBend Medical Group, who discussed the ownership and funding of OakBend Medical Group: OakBend Medical Group is a Texas nonprofit corporation certified by the Texas Medical Board. The sole member of OakBend Medical Group is OakBend Medical Center. As the member, OakBend Medical Center has the power to appoint and remove the Board and management. Additionally, other powers reserved to the member include: approval of all budgets, mergers, acquisitions and sale of real assets; creation of partnerships or joint ventures and dissolution or liquidation, among other powers. OakBend Medical Center provides funding for the operations of OakBend Medical Group.

OakBend Medical Group argued that due to the relationship between the entities, it shared OakBend Medical Center’s immunity from suit, which was not waived for any of Somer’s claims.

Somer responded to both pleas to the jurisdiction. She argued that her tort claims fell within the Tort Claims Act’s “condition or use of tangible personal property” waiver. To Somer, whether her personal information constituted tangible

personal property was immaterial. The cause of her alleged injury was OakBend Medical Center’s failure to safeguard its patients’ and employees’ personal information on its computer network and servers, which does constitute tangible personal property. The unsecured state of the network and servers was the condition of tangible personal property that allegedly caused Somer’s injuries. She also argued that her unjust enrichment claim fell within a recognized waiver of governmental immunity because by accepting payment from Somer but not providing adequate data security, OakBend Medical Center was wrongfully withholding funds that belonged to Somer. Janssen and Henderson filed a substantively identical response to OakBend Medical Center’s plea to the jurisdiction in their case.

With respect to OakBend Medical Group’s argument that it shared in OakBend Medical Center’s governmental immunity, Somer argued that OakBend Medical Group did not have the same governmental immunity because it was a private entity, not a political subdivision. Even if OakBend Medical Center “controlled and funded” OakBend Medical Group, OakBend Medical Group did not present evidence reflecting that it had “no discretion in all of its functions” or that OakBend Medical Center controlled OakBend Medical Group’s data security measures.

Given the substantively identical issues raised in Somer’s suit and Janssen and Henderson’s suit, the patients moved for consolidation of the two suits. The

OakBend entities did not oppose this relief, and the 434th District Court granted the motion and consolidated the cases into Somer’s suit pending before it.

Following hearings on the pleas to the jurisdiction, the trial court granted both pleas filed by OakBend Medical Center and the plea filed by OakBend Medical Group. This appeal followed.

Governmental Immunity Each of the patients’ issues on appeal challenges the rulings granting the pleas to the jurisdiction. First, Somer argues that OakBend Medical Group is a private nonprofit corporation, not a political subdivision, and therefore it is not entitled to share the governmental immunity of its parent company, OakBend Medical Center.

Next, all three patients argue that their claims against both OakBend entities fall within a waiver of governmental immunity: (1) for the patients’ tort claims, the tangible personal property waiver of the Tort Claims Act; and (2) for the patients’ unjust enrichment claim, a waiver allowing plaintiffs to sue for recovery of money or other property wrongfully taken or withheld by the state.

A. Standard of Review Political subdivisions of the state are immune from suit unless state law waives the governmental unit’s immunity. City of Austin v. Powell, 704 S.W.3d 437, (Tex. 2024). Because sovereign immunity is a common-law doctrine, the judiciary has the responsibility to “decide when our State and its political

subdivisions have immunity and to define its boundaries.” Nettles v. GTECH Corp., 606 S.W.3d 726, 731 (Tex. 2020). The Legislature has the responsibility to determine whether to waive immunity and to what extent. Id. A party seeking dismissal on immunity grounds bears the burden to establish that it is a governmental entity entitled to governmental immunity. Lubbock Cnty.

Water Control & Improvement Dist. v. Church & Akin, L.L.C., 442 S.W.3d 297, 305 (Tex. 2014). Once that burden is satisfied, the burden shifts to the party suing a governmental unit to affirmatively show a waiver of immunity. Powell, 704 S.W.3d at 447. There is “a presumption against any waiver until the plaintiff establishes otherwise.” Rattray v. City of Brownsville, 662 S.W.3d 860, 866 (Tex. 2023).

Without a provision of state law establishing a waiver of governmental immunity, “no court is empowered to hear tort cases against and impose liability on ‘governmental unit[s].’” Id.; EBS Sols., Inc. v. Hegar, 601 S.W.3d 744, 749 (Tex. 2020) (“Sovereign immunity implicates a court’s subject matter jurisdiction.”).

We review a trial court’s ruling on a plea to the jurisdiction de novo. City of San Antonio v. Maspero, 640 S.W.3d 523, 528 (Tex. 2022). To determine whether the plaintiff has met her burden to affirmatively show a waiver of immunity, we consider the facts alleged by the plaintiff and any jurisdictional evidence submitted by the parties. Id.; Powell, 704 S.W.3d at 447–48. When there is a dispute over jurisdictional facts, the plaintiff must raise a fact issue concerning the applicability

of an immunity waiver. Powell, 704 S.W.3d at 448. In that circumstance, we take as true all evidence favorable to the nonmovant, and we indulge every reasonable inference and resolve any doubts in the nonmovant’s favor. Id. The trial court may not grant a plea to the jurisdiction if the evidence raises a fact question concerning jurisdiction. Id. If, however, the evidence does not raise a question concerning the existence of a jurisdictional fact, the trial court must grant the plea. Id. B. Whether OakBend Medical Group is Entitled to Governmental Immunity Somer does not contest that OakBend Medical Center, as a municipal-created hospital authority, enjoys governmental immunity from suit. OakBend Med. Ctr. v. Martinez, 515 S.W.3d 536, 541–42 (Tex. App.—Houston [14th Dist.] 2017, no pet.) (concluding that OakBend Medical Center qualifies as “governmental unit” under Tort Claims Act because its evidence established “that it is owned by a hospital authority created by the City of Richmond”); Richmond, Tex., Code of Ordinances, ch. 2, art. V, §§ 2-274–276 (2015). But she denies that the parent’s immunity passes down to the subsidiary.

1. Relationship between OakBend Medical Center and OakBend Medical Group Health and Safety Code chapter 262 allows the governing body of a municipality to adopt an ordinance creating a hospital authority if the body finds that

creation of the authority “is in the best interest of the municipality and its residents.”

TEX. HEALTH & SAFETY CODE § 262.003(a). A hospital authority may then “form and sponsor a nonprofit corporation under the Texas Nonprofit Corporation Law . . . to own and operate all or part of one or more ancillary health care facilities consistent with the purposes of an authority under” chapter 262. Id. § 262.037(a); see TEX. BUS. ORGS. CODE §§ 22.001–.516 (setting out statutory provisions specifically applicable to nonprofit corporations).

The City of Richmond has enacted ordinances establishing a hospital authority (OakBend Medical Center), and at some point, the hospital authority created a nonprofit corporation as authorized by section 262.037—OakBend Medical Group. See Richmond, Tex., Code of Ordinances, ch. 2, art. V, §§ 2-274– (2015). Joseph Freudenberger, OakBend Medical Center’s CEO and OakBend Medical Group’s president, described the relationship between the OakBend entities in a declaration attached to OakBend Medical Group’s plea to the jurisdiction: OakBend Medical Group is a Texas nonprofit corporation certified by the Texas Medical Board. The sole member of OakBend Medical Group is OakBend Medical Center. As the member, OakBend Medical Center has the power to appoint and remove the Board and management. Additionally, other powers reserved to the member include: approval of all budgets, mergers, acquisitions and sale of real assets; creation of partnerships or joint ventures and dissolution or liquidation, among other powers. OakBend Medical Center provides funding for the operations of OakBend Medical Group.

This declaration is the only evidence in the appellate record addressing the connection between the entities.

The record contains no evidence concerning the functions that the respective entities perform; how much control OakBend Medical Center exercises over OakBend Medical Group’s day-to-day activities; any contracts or agreements between the entities describing their respective responsibilities; or whether OakBend Medical Group has any sources of funding other than OakBend Medical Center. The record also contains no evidence relating to whether the OakBend entities maintain separate computer systems and servers; which servers were compromised during the ransomware attack; or which entity was responsible for implementing data security practices and procedures.

2. “Arm of the State” immunity When determining whether an entity authorized by the Legislature is entitled to share in the State’s immunity, we consider whether “the governing statutory authority demonstrates legislative intent to grant an entity the ‘nature, purposes, and powers’ of an ‘arm of the State government.’” CPS Energy v. Elec. Reliability Council of Tex., 671 S.W.3d 605, 621 (Tex. 2023) (quoting El Paso Educ. Initiative, Inc. v. Amex Props., LLC, 602 S.W.3d 521, 527 (Tex. 2020)). We must also consider whether extending immunity would “satisfy the political, pecuniary, and pragmatic policies underlying our immunity doctrines.” Id. (quoting Rosenberg Dev. Corp. v.

Imperial Performing Arts, Inc., 571 S.W.3d 738, 750 (Tex. 2019)). If both requirements are met, the entity “is a government unit unto itself” that may assert immunity “in its own right when it performs a governmental function.” Id. (quoting Univ. of the Incarnate Word v. Redus, 602 S.W.3d 398, 405 (Tex. 2020)).

The Texas Supreme Court has addressed this form of immunity several times in recent years. In Rosenberg Development Corporation v. Imperial Performing Arts, the court considered whether a municipally created economic development corporation under the Local Government Code’s Development Corporation Act was a governmental entity in its own right that could assert immunity. See 571 S.W.3d at 741. The court examined whether “indicia of legislative intent” existed in the statutes authorizing creation of economic development corporations and found two statutory provisions particularly relevant. Id. at 748–49. First, the Development Corporation Act explicitly stated that an economic development corporation was not a political subdivision. Id. (citing TEX. LOC. GOV’T CODE § 501.055(b)). Second, the Act prohibited a municipality from delegating to an economic development corporation “any of [the municipality’s] attributes of sovereignty, including the power to tax, the power of eminent domain, and the police power.” Id. at 749 (citing TEX. LOC. GOV’T CODE § 501.010). Additionally, the Development Corporation Act described the entity as a “private, nonprofit” corporation and gave it the powers that

the Business Organizations Code generally bestows upon nonprofit corporations. Id. (citing TEX. LOC. GOV’T CODE §§ 501.053–.054).

When determining that the economic development corporation at issue was not a governmental entity entitled to assert its own immunity, the court focused on these statutory provisions that “expressly denied economic development corporations significant governmental characteristics.”4 Id. Rather than demonstrating the Legislature’s intent that an economic development corporation exist as a distinct governmental entity from the municipality that created it, the Development Corporation Act instead “evinces clear legislative intent that an economic development corporation is not an arm of state government.” Id. at 750.

The Texas Supreme Court contrasted the Development Corporation Act with two chapters of the Government Code—chapter 2259 (allowing local governments to self-insure) and chapter 791 (allowing local governments to enter interlocal agreements)—which provided “indicia of legislative intent” that a joint self- insurance fund formed by nearly 100 local governmental entities was a discrete governmental unit separate from its governmental-unit members such that it enjoyed governmental immunity in its own right. See Rosenberg Dev. Corp. v. Imperial Performing Arts, Inc., 571 S.W.3d 738, 749 (Tex. 2019) (discussing Ben Bolt-Palito Blanco Consol. Indep. Sch. Dist. v. Tex. Political Subdivisions Prop./Cas. Joint Self- Ins. Fund, 212 S.W.3d 320, 322, 324–26 (Tex. 2006)). For example, chapter 791 expressly authorized “combinations of political subdivisions,” included combinations within the meaning of “local government,” and allowed those combinations “to perform governmental functions and services”; and chapter 2259 stated that expending money to fund self-insurance was a “public purpose of the governmental unit.” Id. (quotations omitted). Although the self-insurance fund’s “nature, purposes, and powers demonstrated the Legislature’s intent that the fund exist as a distinct governmental entity,” such indicia did not exist in the Development Corporation Act. Id. (quotations omitted).

The Texas Supreme Court was not persuaded by the argument that economic development corporations—unlike “ordinary” nonprofit corporations—are subject to statutory requirements such as the Open Meetings Act and Public Information Act. Id. “[H]eavily regulating an entity does not equate to conferring governmental- entity status.” Id. The court found similarly unpersuasive the argument that the Development Corporation Act described the promotion and development of businesses—the function of economic development corporations—as “public purposes” because “merely engaging in an act that serves a public purpose says nothing about the nature of the entity itself.” Id. Economic development corporations may pursue projects that “have a governmental flair,” but these projects are “not so uniquely or so definitively [governmental] that only a governmental entity would engage in those activities.” Id. In determining that the economic development corporation did not have immunity as an “arm of the State,” the court also considered the “nature and purposes of immunity,” including “political, pecuniary, and pragmatic” rationales for the immunity doctrine. Id. First, “[g]overnmental immunity benefits the public by preventing disruption of key governmental services.” Id. Economic development corporations “are authorized for the limited purpose of promoting and developing enterprises to encourage employment and the public welfare,” but these are not “essential services.” Id. at 751.

Next, governmental immunity “respects the separateness of the branches of government,” but the Legislature “expressly chose not to imbue economic development corporations with indicia of status as a distinct governmental entity.”

Id. The Legislature did not “grant these entities ‘powers of government’ to perform essential governmental functions or activities.” Id. Finally, concerns over public fiscal matters do not justify extending immunity to economic development corporations. Id. A major purpose of immunity doctrines is to act as a safeguard against unforeseen expenditures that occur when a governmental entity must defend lawsuits and pay judgments. Id. But the activities of an economic development corporation “center on specific ‘projects’ that have been designated in advance and memorialized by performance agreements.” Id. Additionally, the Development Corporation Act “contains provisions limiting liability and financial exposure.” Id. Therefore, the court did not perceive a “genuine risk of unforeseen expenditures to be visited on the government.” Id. Ultimately, when considering the Legislature’s intent as expressed in the Development Corporation Act and the purposes of governmental immunity, the Texas Supreme Court concluded that although economic development corporations

fulfill public purposes, they “do not exist quite like an arm of the state government, imbued with aspects of sovereignty such as immunity from suit.”5 Id. at 752.

The court reached the opposite conclusion in two recent cases involving an open-enrollment charter school and the Electric Reliability Council of Texas (“ERCOT”). In El Paso Education Initiative v. Amex Properties, the court concluded that open-enrollment charter schools “act as an arm of the State government.” 602 S.W.3d at 529. The Legislature expressly made open-enrollment charter schools “part of the public school system of this state.” Id. at 528 (quoting TEX. EDUC. CODE § 12.105). Under their charters with the Texas Commissioner of Education, these schools must meet certain financial, governing, educational, and operational standards. Id. (quotations omitted). Typically private, nonprofit organizations hold the charters, but the holder risks revocation of its charter if it does not follow state law and Commissioner regulations applicable to public schools. Id. at 528–29. Open-

The following year, the Texas Supreme Court reached a similar conclusion and refused to hold that a private university that had formed its own campus police department—as authorized by the Legislature—was an arm of the State government such that it was entitled to governmental immunity. See Univ. of the Incarnate Word v. Redus, 602 S.W.3d 398, 406–13 (Tex. 2020). The court emphasized that the university was a private entity; the police department answered to university—not State—leadership and management; the university’s “primary mission is private education, not law enforcement”; the police department did not receive state funding, nor was the State involved in setting policies and procedures or making personnel decisions; the State exercised no control over the police department; no public tax dollars were at stake in the lawsuit; the Legislature authorized but did not mandate the creation of campus police departments; and any judgments that might arise from the police department’s actions would be paid by the university, not the State. Id. at 406–10. enrollment charter schools are “largely publicly-funded.” Id. at 529. The Legislature has also provided that “[i]n matters related to operation of an open-enrollment charter school, an open-enrollment charter school or charter holder is immune from liability and suit to the same extent as a school district . . . .” Id. (quoting TEX. EDUC.

CODE § 12.1056(a)).

Extending immunity to these schools also satisfies the purposes of the immunity doctrines because using school funds to defend lawsuits and pay judgments “affects the State’s provision of public education and reallocates taxpayer dollars from the legislature’s designated purpose.” Id. at 530. Allowing immunity also “respects the legislature’s decision to fulfill its constitutional obligation to provide a free, public education through charter schools, its allocation of tax dollars to meet that objective, and its directive that charter schools and charter-holders have immunity from suit and liability to the same extent as public schools.” Id. The court therefore held that open-enrollment charter schools are entitled to governmental immunity. Id. In considering ERCOT’s immunity in CPS Energy v. Electric Reliability Council of Texas, the Texas Supreme Court emphasized that the State—primarily through the Public Utilities Commission (“PUC”)—exercises a high level of control and authority over ERCOT: “the state has complete authority over everything ERCOT does to perform its statutory functions.” 671 S.W.3d at 623. The PUC has

“authority over ERCOT’s governance” and “complete authority over ERCOT’s finances and budget.” Id. at 623–24 (quotations omitted). The Legislature expressly provided that ERCOT “is directly responsible and accountable” to the PUC, and if ERCOT does not adequately perform its functions, the PUC can “take appropriate action,” including decertifying ERCOT as the independent system operator. Id. at (quoting TEX. UTIL. CODE § 39.151(d)). Although ERCOT’s role is not “clearly analogous to a public entity like a police department or a public school,” as the independent system operator in charge of Texas’ power grid, “it provides an essential governmental service.” Id. at 623. ERCOT is also subject to sunset review and the Open Meetings Act, “requirements typically reserved for state entities,” although these requirements alone are not dispositive. Id. at 624–25.

The court also concluded that recognizing ERCOT’s immunity “satisfies the political, pecuniary, and pragmatic policies underlying our immunity doctrines.” Id. at 627 (quotations omitted). While tax dollars do not fund ERCOT, “any damages payments would nevertheless come from the state and the public” because ERCOT would need to raise a system administration fee—the primary source of its funding— to pay a judgment, “resulting in higher costs for electricity for consumers.” Id. Additionally, “the Legislature appears to consider ERCOT’s money and assets to be state assets,” as the PUC has authority over how ERCOT raises and spends money, and the Utilities Code requires ERCOT to transfer its assets to its successor if the

PUC decertifies it. Id. (quoting TEX. UTIL. CODE § 39.151(d)). Imposing a damages award on ERCOT “would run afoul of the Legislature’s determination that the PUC alone has ‘complete authority’ over ERCOT’s finances,” so recognizing ERCOT’s immunity respects separation of powers principles. Id. Because “clear legislative intent” exists that ERCOT should have the “nature, purposes, and powers” of an arm of the State government and the purposes underlying the immunity doctrines would be satisfied, the court held that ERCOT was entitled to governmental immunity as an arm of the State. Id. at 628.

No court has addressed whether the Legislature has demonstrated intent to grant a nonprofit corporation created by a hospital authority under Health and Safety Code section 262.037 “the ‘nature, purposes, and powers’ of an ‘arm of the State government.’” Id. at 621. Based on the relevant provisions of the Health and Safety Code, caselaw, and the state of the record, we conclude that OakBend Medical Group most closely resembles the economic development corporation at issue in Rosenberg Development—rather than open-enrollment charter schools and ERCOT—and therefore does not have immunity as an arm of the State government.

As discussed above, a hospital authority may form a nonprofit corporation “to own and operate all or part of one or more ancillary health care facilities consistent with the purposes of an authority under this chapter.” TEX. HEALTH & SAFETY CODE § 262.037(a). The hospital authority’s board of directors “shall appoint the board of

directors of a nonprofit corporation formed under this section.” Id. § 262.037(b). The hospital authority “may contribute money” to the nonprofit corporation, and if it does so, it “shall establish procedures and controls sufficient to ensure that the money is used by the corporation for public purposes.” Id. § 262.037(c). While a hospital authority “is a body politic and corporate,” id. § 262.003(d), the Legislature did not grant that designation to a nonprofit corporation created by a hospital authority. See id. § 262.037.

The Legislature also provided that a nonprofit corporation created under section 262.037 “has the same powers as a development corporation under [Health and Safety Code] Section 221.030.”6 Id. § 262.037(d). That section grants a development corporation powers including, for example, the ability to acquire land, sell property, and appoint agents. Id. § 221.030(a)(1), (9), (10). But section 221.030 contains an important restriction on a development corporation’s powers, a restriction that mattered in Rosenberg Development: a municipality, county, or district that creates a development corporation—a “sponsoring entity”—“may not delegate to a development corporation the power of taxation or eminent domain, police power, or an equivalent sovereign power of the state or the sponsoring entity.”

Health and Safety Code Chapter 221 grants authority to a municipality, county, or district to create “one or more nonmember, nonstock development corporations for the sole public purpose of acquiring, constructing, providing, improving, financing, and refinancing a health facility to assist the maintenance of public health.” TEX. HEALTH & SAFETY CODE § 221.011(a).

Id. § 221.030(c); Rosenberg Dev. Corp., 571 S.W.3d at 749–50 (concluding that Legislature had “expressly denied economic development corporations significant governmental characteristics—political-subdivision-status and attributes of sovereignty” evincing “clear legislative intent that an economic development corporation is not an arm of state government”).

Section 262.037 contemplates some governmental oversight of a nonprofit corporation, as the hospital authority’s board must appoint the nonprofit corporation’s board of directors, and the hospital authority “shall establish procedures and controls sufficient to ensure that the money is used by the corporation for public purposes” if the authority contributes money to the nonprofit corporation.

TEX. HEALTH & SAFETY CODE § 262.037(b)–(c). This amount of oversight, however, is limited compared to the regulations imposed upon an open-enrollment charter school, which must meet the Commissioner of Education’s “financial, governing, educational, and operational standards” and must follow the Commissioner’s regulations applying to public schools or risk revocation of its charter. See El Paso Educ. Initiative, 602 S.W.3d at 528–29. And it falls far short of the oversight statutorily imposed on ERCOT, which is subject to a high degree of control and authority over it exercised by the PUC. See CPS Energy, 671 S.W.3d at 623–24. The provisions in section 262.037 providing for hospital authority oversight do not “overcome the Legislature’s clear and express directives” that the nonprofit

corporation does not have sovereign powers. See Rosenberg Dev. Corp., 571 S.W.3d at 750; TEX. HEALTH & SAFETY CODE § 221.030(c).

The OakBend entities argue that “the undisputed facts demonstrate that OakBend [Medical Center] controls OakBend [Medical Group’s] operations and governance,” pointing to Freudenberger’s declaration that OakBend Medical Center is OakBend Medical Group’s sole member, and listing powers reserved to OakBend Medical Center in this capacity, including composition of OakBend Medical Group’s board and management; approval of budgets, mergers, acquisitions, and sale of real assets; creation of partnerships or joint ventures; and dissolution or liquidation. OakBend Medical Center also provides funding to OakBend Medical Group.

Freudenberger’s declaration, however, says nothing about the day-to-day operations of the entities, such as who hires and fires medical personnel or makes operational decisions concerning hospitals or other healthcare facilities. It establishes that OakBend Medical Center has some authority and control over OakBend Medical Group, but it is silent on the level of control relating to the purpose for which OakBend Medical Group was ostensibly created: “to own and operate all or part of one of more ancillary health care facilities.” See TEX. HEALTH & SAFETY CODE § 262.037(a); see also id. § 262.022(d) (providing that if nonprofit corporation uses, operates, or acquires hospital, “the [hospital] authority may delegate to the

nonprofit corporation . . . the duty to establish the procedures and policies” for hospital’s operation).

We must also address whether extending immunity to a nonprofit corporation created under section 262.037 is “necessary to satisfy the political, pecuniary, and pragmatic policies underlying [the] immunity doctrines.” See Rosenberg Dev. Corp., 571 S.W.3d at 750. In arguing that it is, the OakBend entities focus on two policy goals: protecting the public treasury and preserving separation of government powers.

The OakBend entities first argue that it is undisputed that OakBend Medical Center controls OakBend Medical Group’s budget and provides funding for OakBend Medical Group. Thus, if OakBend Medical Group must pay a judgment, those funds would come from increased fees charged to the public or funds provided by OakBend Medical Center, which is immune from suit. The OakBend entities also argue that extending immunity to OakBend Medical Group recognizes “the separation of powers principle inherent in OakBend [Medical Center’s] control over OakBend [Medical Group’s] finances,” pointing out that OakBend Medical Center has the sole power to sell OakBend Medical Group’s assets or dissolve OakBend Medical Group.

As the patients point out, however, the record says little about the OakBend entities’ finances. Freudenberger declared only that OakBend Medical Center

retained the power to approve OakBend Medical Group’s budgets and that OakBend Medical Center “provides funding for the operations of OakBend Medical Group.”

He did not state that OakBend Medical Center provides all funding for OakBend Medical Group. We note that a hospital authority that creates a nonprofit corporation “may contribute money to or solicit money for the nonprofit corporation,” but it is not required to do so. TEX. HEALTH & SAFETY CODE § 262.037(c) (emphasis added).

This leaves open the possibility that OakBend Medical Group receives funding from other sources such that if it is required to pay any judgments, those funds might not necessarily come from increased charges to the public or funds contributed by OakBend Medical Center. Based on this record, we do not agree that a judgment against OakBend Medical Group is effectively a judgment against OakBend Medical Center, an entity that has immunity from suit.

“Governmental immunity does not extend like ripples from a pebble tossed into a pond but, instead, is limited to those entities acting as an arm of state government.” Rosenberg Dev. Corp., 571 S.W.3d at 752. We conclude that although a nonprofit corporation like OakBend Medical Group fulfills a public purpose by providing healthcare, the Legislature has not demonstrated clear legislative intent that such an entity should be considered an arm of the State government. See id. at 750. Additionally, we conclude on this record that extending immunity to OakBend Medical Group does not further the purposes underlying the immunity doctrines. We

therefore hold that OakBend Medical Group is not entitled to governmental immunity as an arm of the State government.

3. Derivative immunity We turn now to whether OakBend Medical Group enjoys derivate immunity based on the immunity of its parent and sole member OakBend Medical Center.

Whether a non-governmental entity can share a political subdivision’s immunity derivatively “is a distinct analytical inquiry” from whether the entity effectively acts as an arm of state government. Id. at 752. The Texas Supreme Court has never adopted the derivative-immunity doctrine or standards to use when determining the scope of that doctrine. Nettles, 606 S.W.3d at 733. The circumstances under which derivate immunity exists are “ill-defined,” but the court has held that the absence of governmental control over the entity’s work “affirmatively precludes it.” Rosenberg Dev. Corp., 571 S.W.3d at 751–52 (citing Brown & Gay Eng’g v. Olivares, 461 S.W.3d 117, 126 (Tex. 2015)); see also Nettles, S.W.3d 733–37 (declining to adopt derivate immunity doctrine but noting that even if doctrine was recognized, private contractor would not be entitled to it because contractor retained discretion and governmental unit did not control contractor’s work).

The inquiry focuses on whether the governmental entity had sufficient control over the actions of the entity seeking derivative immunity such that the actions were

“effectively attributable” to the governmental entity or whether the other entity had some discretion. See Nettles, 606 S.W.3d at 733. We look at the “complained-of conduct” to consider whether “the alleged cause of the injury was not the independent action of the [entity seeking derivative immunity], but the action taken by the government through the [entity].” Brown & Gay Eng’g, 461 S.W.3d at 125.

For example, in Brown & Gay Engineering, a case that arose out of a fatal car accident on the Westpark Tollway, the Texas Supreme Court focused on the fact that the plaintiffs alleged Brown & Gay—a private contractor—was independently negligent in how it designed road signs and traffic layouts, an action that the toll road authority had delegated to the contractor under their contract. Id. at 126.

Because Brown & Gay “was an independent contractor with discretion to design the Tollway’s signage and road layouts,” the toll road authority’s lack of control over those actions was “determinative,” and the contractor could not rely on derivative immunity.7 Id.; see Nettles, 606 S.W.3d at 736–37 (concluding that contractor could

The Texas Supreme Court first considered this doctrine over thirty years ago in K.D.F. v. Rex, a mandamus proceeding in which three Kansas entities—the Kansas Public Employees’ Retirement System (“KPERS”); Kansas Debt Fund (“K.D.F.”), a bank-created partnership that held securities on behalf of KPERS; and Pacholder Associates, KPERS’ independent investment adviser—argued that under principles of interstate comity, Texas courts had to recognize their sovereign immunity under Kansas law and decline to exercise jurisdiction over them. See 878 S.W.2d 589, 591 (Tex. 1994) (orig. proceeding). KPERS was a Kansas governmental entity entitled to sovereign immunity, but K.D.F. and Pacholder were not governmental entities, and the question was whether they were entitled to share in KPERS’ immunity. Id. at 596. not rely on derivative immunity through Texas Lottery Commission because contractor “had discretion regarding the conduct at issue: choosing the wording of the game instructions”).

Our Court has also addressed this doctrine. Lenoir v. U.T. Physicians involved a malpractice claim against doctors, a nurse, and U.T. Physicians, a subsidiary entity of a governmental entity with immunity from suit: the University of Texas Health Science Center at Houston (“UTHSCH”). 491 S.W.3d 68, 77 (Tex. App.—Houston [1st Dist.] 2016, pet. denied). The plaintiffs alleged that U.T. Physicians employed a nurse who acted negligently, and U.T. Physicians was liable for the nurse’s negligence. Id. U.T. Physicians argued that it was entitled to derivative immunity through UTHSCH. Id. at 82.

The jurisdictional evidence presented by the parties included the contract between UTHSCH and U.T. Physicians. The contract required U.T. Physicians to provide UTHSCH with “the non-physician personnel reasonably necessary” for the

In holding that K.D.F. could but Pacholder could not, the court focused on whether the entities performed “essentially ministerial functions under the control and direction of KPERS.” Id. at 597. K.D.F. operated “solely upon the direction of KPERS” and exercised no discretion in its activities. Id. K.D.F. and KPERS were therefore “not distinguishable from one another; a lawsuit against one is a lawsuit against the other.” Id. Pacholder, on the other hand, was an investment adviser and its actions “necessarily involve[d] considerable discretion.” Id. Rather than acting on KPERS’ direction and control, its role was “more in the nature of advising KPERS how to proceed.” Id. Pacholder was therefore not entitled to immunity protection “unless it can demonstrate its actions were actions of the Kansas government, executed subject to the control of KPERS.” Id. practice, granted U.T. Physicians the sole right to hire and fire such personnel, and required U.T. Physicians to determine the compensation of such personnel and procure professional liability insurance for such personnel. Id. at 86. This contract established that U.T. Physicians had discretion with respect to conduct that formed the basis of the plaintiffs’ complaint, the provision of medical services: The contract evinces UTP’s right to direct the nursing staff, control its compensation, and insure against professional liability for its acts. In doing so, UTP was granted discretion. It acted for the government— assisting it in its provision of medical services and education—not as the government without discretion or diversion.

Id. Immunity therefore did not extend to U.T. Physicians. Id. U.T. Physicians’ argument that it was entitled to derivative immunity because UTHSCH exerted control over it—UTHSCH created U.T. Physicians, chose its board of directors, retained authority to amend its bylaws, and would recover U.T.

Physicians’ property should it cease to exist—did not persuade us that immunity should be extended. Id. at 88. The pertinent question was not whether the governmental entity had any control over the entity seeking immunity, but “whether the entity that is seeking to benefit from another’s immunity had discretion as it relates to the activities underlying the plaintiff’s claims.” Id. (emphasis added).

UTHSCH might have retained the ability to dissolve U.T. Physicians, but that did not necessarily mean that UTHSCH had “withheld all discretion from UTP in its operations or, more specifically, in the management of UTP’s nursing staff.” Id.

Here, Somer complains about the OakBend entities’ actions and omissions in allegedly allowing their computer network to be breached in a ransomware attack.

Somer’s petition does not differentiate between the actions and omissions of OakBend Medical Center and OakBend Medical Group, instead referring to both entities collectively as “OakBend.” The OakBend entities argue that Somer’s claims “arise out of a single Cybercriminal Attack on OakBend [Medical Center’s] computer network—not separate, discretionary actions taken by OakBend [Medical Group].” The record, however, does not support that assertion.8 The only evidence submitted in connection with the pleas to the jurisdiction is Freudenberger’s declaration, quoted above, which generally describes powers that OakBend Medical Center retains over OakBend Medical Group, powers that do not relate to the complained-of conduct here. This declaration is silent about whether OakBend Medical Group has a separate computer network or servers from OakBend

As support for this assertion, the OakBend entities cite three pages of the record.

They first cite the second page of Somer’s petition, in which she alleged that “[o]n or about September 1, 2022, OakBend [defined earlier in the petition as referring collectively to both OakBend entities] determined that unauthorized individuals had gained access to its network systems and encrypted and removed the [personal information] of Plaintiff and Class members.” The OakBend entities then cite the first page of Janssen and Henderson’s petition, in which they asserted that the data breach was “perpetrated against Defendant OakBend,” which in their petition only refers to OakBend Medical Center, the only entity they asserted claims against.

Finally, the OakBend entities cite the “Notice of Data Breach” that Janssen and Henderson received and attached to their petition, which stated that “OakBend Medical Center’s computer network experienced a ransomware attack” and did not mention OakBend Medical Group. None of these documents were attached as evidence to the OakBend entities’ pleas to the jurisdiction.

Medical Center, which entity is responsible for data security practices and procedures, whether OakBend Medical Group has its own information technology department, and—assuming the OakBend entities have separate networks and servers—which entity’s network was compromised during the ransomware attack.

The appellate record is therefore silent about whether OakBend Medical Group retains any discretion related to data security—the focus of Somer’s allegations—or whether it is subject to OakBend Medical Center’s control in this regard.

It may very well be that OakBend Medical Group has no control over data security, that OakBend Medical Center is the only OakBend entity that exercises control over such matters, or that OakBend Medical Group does not have its own computer network or servers and instead relies entirely on those of OakBend Medical Center. But we cannot determine that based on this record. When there is a dispute over jurisdictional facts, we must indulge every reasonable inference and resolve any doubts in the nonmovant’s favor. Powell, 704 S.W.3d at 448.

On this record, even assuming that derivative immunity is a doctrine that exists in Texas, we conclude that OakBend Medical Group has not established that it is entitled to derivative immunity based on OakBend Medical Center’s immunity from suit. See Lenoir, 491 S.W.3d at 90 (holding that in light of plaintiff’s negligence allegations, evidence of U.T. Physicians’ discretion in managing nursing staff, and other contractual requirements, U.T. Physicians had not established “that

UTHSCH’s immunity from suit extends to it as a creation of UTHSCH, either as an agent or a wholly-owned subsidiary”). We hold that the trial court erred by granting OakBend Medical Group’s plea to the jurisdiction.

We therefore sustain Somer’s first issue.

C. Waiver of Governmental Immunity Having concluded that OakBend Medical Group has not established that it is entitled to governmental immunity, we now address whether the patients’ claims against OakBend Medical Center—an entity that undisputedly enjoys governmental immunity—fall within a waiver of that immunity. We turn first to whether the patients’ tort claims fall within the tangible personal property waiver of the Tort Claims Act.

1. The Tort Claims Act’s condition or use of tangible personal property waiver The Tort Claims Act waives immunity for certain torts. Powell, 704 S.W.3d at 448. Relevant here, the Act waives immunity for “personal injury and death so caused by a condition or use of tangible personal or real property if the governmental unit would, were it a private person, be liable to the claimant according to Texas law.” TEX. CIV. PRAC. & REM. CODE § 101.021(2).

The Tort Claims Act does not define “personal injury.”9 Few Texas courts have addressed what qualifies as “personal injury” in this context, but this Court is one of them. In Hencerling v. Texas A&M University, a local business owner in the Bryan-College Station area sued after the university opened a new fitness center on campus, which allegedly led to decreased revenues and closure of the owner’s own health clubs. 986 S.W.2d 373, 374 (Tex. App.—Houston [1st Dist.] 1999, pet. denied). We held that section 101.021(2) did not waive immunity because the owner’s alleged injuries were business and financial losses. Id. at 375. “Financial losses are not personal injury damages,” and the owner’s financial losses were “neither dependent on, nor the result of, personal injury or death.” Id.; Tex. Dep’t of Transp. v. City of Floresville Elec. Power & Light Sys., 53 S.W.3d 447, 455–56 (Tex. App.—San Antonio 2001, no pet.) (concluding immunity was not waived under section 101.021(2) because plaintiff was “seeking to be indemnified for money it paid to settle claims,” and financial losses are not property or personal injury damages).

The Tort Claims Act includes limitations on the amount of liability of the state government, a unit of local government, a municipality, and an emergency service organization. TEX. CIV. PRAC. & REM. CODE § 101.023. For example, section 101.023(a) limits the state government’s liability to “money damages in a maximum amount of $250,000 for each person and $500,000 for each single occurrence for bodily injury or death and $100,000 for each single occurrence for injury to or destruction of property.” Id. § 101.023(a) (emphasis added). None of the four subsections of this statute use the phrase “personal injury”; instead, they all use the phrase “bodily injury.” See id. § 101.023(a)–(d). The Tort Claims Act does not define “bodily injury.”

Somer alleged the following injuries and damages with respect to her tort claims: • “a substantially increased risk of identity theft and medical identity theft—risks justifying expenditures for protective and remedial services for which they are entitled to compensation”; • “improper disclosure of their PII/PHI [personal identifying information/personal health information]”; • “breach of the confidentiality of their PII/PHI”; • “deprivation of the value of their PII/PHI, for which there is a well- established national and international market”; • “lost time and money incurred to mitigate and remediate the effects of the Data Breach, including the increased risks of identity theft and medical identity theft they face and will continue to face”; and • “overpayment for the services that were received without adequate data security.”10 Janssen and Henderson alleged substantially similar injuries:

Although Somer alleged slightly different injuries with respect to her breach of fiduciary duty claim, we note that breach of fiduciary duty is an intentional tort, and the Tort Claims Act does not waive immunity for intentional torts. See id. § 101.057(2) (providing that Tort Claims Act does not apply to claim “arising out of assault, battery, false imprisonment, or any other intentional tort”); City of Watauga v. Gordon, 434 S.W.3d 586, 589 (Tex. 2014) (stating that limited waiver in section 101.021(2) “does not apply to intentional torts”); Wren v. Midwestern State Univ., No. 05-22-00207-CV, 2023 WL 6139452, at *2 (Tex. App.—Dallas Sept. 20, 2023, no pet.) (mem. op.) (“Due to their status as intentional torts, fraud and breach of fiduciary duty do not fall within this waiver.”); Moorhead v. E.

Chambers Indep. Sch. Dist., No. 01-03-01234-CV, 2004 WL 1470787, at *4 n.4 (Tex. App.—Houston [1st Dist.] July 1, 2004, pet. denied) (mem. op.) (“Claims for breach of fiduciary duty do not fall under the Tort Claims Act.”). Somer therefore has not demonstrated that a waiver of immunity under the Tort Claims Act applies to her breach of fiduciary duty claim. • “out-of-pocket costs for, e.g., purchasing credit monitoring services, credit freezes, credit reports, or other protective measures to deter and detect identity theft”; • “time dealing with the effects of the Data Breach”; • “substantial risk of out-of-pocket fraud losses such as loans opened in their names, medical services billed in their names, tax return fraud, utility bills opened in their names, credit card fraud, and similar identity theft”; • “substantial risk of being targeted for future phishing, data intrusion, and other illegal schemes”; and • “out-of-pocket expenses and the value of their time reasonably incurred to remedy or mitigate the effects of the Data Breach.”

The patients alleged that they have incurred financial losses, expended time, and face an increased risk of future identity theft. These injuries are not “personal injuries” such that the Tort Claims Act’s tangible personal property waiver applies to waive OakBend Medical Center’s governmental immunity. See Hencerling, 986 S.W.2d at 375. The trial court therefore properly granted OakBend Medical Center’s plea to the jurisdiction on the patients’ tort claims.

2. The unjust enrichment claims Finally, we address whether the patients’ claims for unjust enrichment fall within a waiver of immunity.

“Unjust enrichment occurs when a person has wrongfully secured a benefit or has passively received one which it would be unconscionable to retain.” Eun Bok Lee v. Ho Chang Lee, 411 S.W.3d 95, 111 (Tex. App.—Houston [1st Dist.] 2013,

no pet.). A party may recover under an unjust enrichment theory when one person has obtained a benefit from another by fraud, duress, or through taking undue advantage. Heldenfels Bros., Inc. v. City of Corpus Christi, 832 S.W.2d 39, 41 (Tex. 1992). Unjust enrichment is an equitable doctrine. Eun Bok Lee, 411 S.W.3d at 111.

Among the purposes of governmental immunity from suit is the protection of state agencies and their officials from lawsuits for damages. Richardson Hosp. Auth. v. Duru, 387 S.W.3d 109, 114 (Tex. App.—Dallas 2012, no pet.). Regardless of the nature of an equitable claim, governmental immunity bars the claim if the plaintiff seeks money damages as her remedy. Id. The patients, however, argue that their unjust enrichment claims fall within a waiver of OakBend Medical Center’s immunity because the law recognizes an exception to immunity when someone’s money or property has been improperly “withheld” by state officials: “suits to recover money or other property wrongfully taken or withheld by state officials from their rightful owners do not implicate sovereign immunity because, in concept, the disputed property never belongs to the state.” City of Round Rock v. Whiteaker, 241 S.W.3d 609, 634–35 (Tex. App.—Austin 2007, pet. denied).

Based on this legal premise from City of Round Rock, the patients argue that they allege OakBend Medical Center is “wrongfully withholding funds that rightfully belong to each” patient because the patients “conferred a benefit upon [OakBend Medical Center] in the form of monies paid for healthcare services or

other services provided by OakBend Defendants.” This premise could give rise to a doctrinal discussion about whether unjust enrichment constitutes a claim or merely a remedy. See George P. Roach, Unjust Enrichment in Texas: Is It a Floor Wax or a Dessert Topping?, 65 BAYLOR L. REV. 153, 203–40 (2013) (exploring “the ongoing dispute of whether unjust enrichment is a cause of action”).11 But we need not address that issue in this case.

The pleadings here do not allege any such “withholding.” Indeed, the pleadings never even mention withholding. Somer’s petition largely alleges negligence, with allegations of breach of fiduciary duty and negligence per se based on duties imposed by HIPAA and the Federal Trade Commission Act. When Somer states her count alleging an unjust enrichment claim, she realleges and incorporates her prior allegations before pleading: 87. Plaintiff and Class members conferred a monetary benefit upon OakBend in the form of monies paid for healthcare services or other services or through their employment with OakBend. ....

89. As a result of OakBend’s conduct, Plaintiff and Class members suffered actual damages in an amount equal to the difference in value between their payments made with reasonable data privacy and security Compare Tex. State Libr. & Archives Comm’n v. Westmoreland, 703 S.W.3d 805, (Tex. App.—Austin 2024, no pet.) (“Unjust enrichment on its own cannot support a waiver of governmental immunity”), and Richardson Hosp. Auth. v. Duru, 387 S.W.3d 109, 114 (Tex. App.—Dallas 2012, no pet.) (“This Court has held that unjust enrichment is not an independent cause of action.”), with Pepi Corp. v. Galliford, 254 S.W.3d 457, 460 (Tex. App.—Houston [1st Dist.] 2007, pet. denied) (“Unjust enrichment is an independent cause of action.”). practices and procedures that Plaintiff and Class members paid for, and those payments without reasonable data privacy and security practices and procedures that they received.

90. OakBend should not be permitted to retain the money belonging to Plaintiff and Class members because OakBend failed to adequately implement the data privacy and security procedures for itself that Plaintiff and Class members paid for and that were otherwise mandated by federal, state, and local laws and industry standards.

91. OakBend should be compelled to provide for the benefit of Plaintiff and Class members all unlawful proceeds received by it as a result of the conduct and Data Breach alleged herein.

Nothing in Somer’s petition alleged any withholding of property that otherwise belonged to her. The same can be said of the allegations in Janssen and Henderson’s petition.12 Fairly construed, the pleadings do not allege the kind of withholding that would put City of Round Rock into play.

As a result, the unjust enrichment allegations come within the normal rule that “regardless of the nature of the equitable claim, if money damages are the remedy sought, then the claim is barred by governmental immunity.” Richardson Hosp.

Auth., 387 S.W.3d at 114. The Legislature “has not created a waiver of governmental Janssen and Henderson alleged that OakBend Medical Center “funds its data security measures entirely from its general revenue, including payments made by or on behalf of Plaintiff(s) and the Class Members,” and therefore “a portion of the payments made by or on behalf of Plaintiff(s) and the Class Members is to be used to provide a reasonable level of data security.” Instead, OakBend Medical Center “enriched itself by saving the costs it reasonably should have expended on data security measures to secure Plaintiff’s and Class Members’ Personal Information.”

Rather than “providing a reasonable level of security that would have prevented the hacking incident, Defendant instead calculated to increase its own profits at the expense of Plaintiff(s) and Class Members by utilizing cheaper, ineffective security measures.” immunity for equitable claims that seek money damages.” Id. We conclude that the trial court did not err by granting OakBend Medical Center’s plea to the jurisdiction on the patients’ unjust enrichment claims.

We overrule the patients’ second issue.

Conclusion The parent has shown an entitlement to immunity, but the subsidiary has not.

We reverse the trial court’s order granting OakBend Medical Group’s plea to the jurisdiction, and we remand Somer’s claims against OakBend Medical Group for further proceedings. We affirm the trial court’s orders granting OakBend Medical Center’s pleas to the jurisdiction.

David Gunn Justice Panel consists of Justices Guerra, Gunn, and Dokupil.